Capita plc and Capita Pension Services Limited

What the regulator decided

In March 2023 a ransomware actor obtained access to Capita's corporate environment via a malware-bearing download on a Capita employee laptop and exfiltrated personal data of approximately 6.6 million people, including pension members of 325 client schemes; Capita had been aware of the underlying vulnerabilities, did not treat the early indicators as a security incident, and lacked adequate technical and organisational measures, breaching Article 5(1)(f) and Article 32 UK GDPR.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate. Fine split: GBP 8M against Capita plc as controller + GBP 6M against Capita Pension Services Limited as processor. The initial starting point was GBP 58M; settlement-and-no- appeal plus group-double-punishment adjustments reduced the final to GBP 14M. Cite as a recent precedent that the ICO will fine a processor directly under Article 32, not only the controller.